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I. INTRODUCTION 

The government’s Opposition to Defendants’ Motion to Compel production of a 
functioning version of the Backpage databases is an exercise in obfuscation. Instead of 
addressing the issue raised in Defendants’ Motion, the government spends pages recounting 
its purported production of discovery not at issue in this Motion. On the issue that is raised 
in Defendants’ Motion — Defendants’ need for and right to functional databases - the 
government misleads the Court, falsely claiming that it produced the servers in the same 
condition that “it was seized and received by the government.” (Doc. 696 at 14.) 

The government indicted Defendants for their roles in connection with the website 
Backpage.com. The government alleges that aU adult ads on the website were for prostitution 
or sex trafficking, that the operations and practices of the site were designed to promote or 
facilitate this by creating ads for illegal conduct or editing ads to hide illegal conduct, and that 
Defendants each knowingly participated in this. None of this is true, as evidence concerning 
actual ads and Backpage’s actual practices in screening, blocking, removing, and reporting ads 
would show. This evidence was available in the Backpage databases and systems as they 
existed when the government effected its seizures of all the servers beginning in April 2018. 

The government does not dispute any of this, but instead says that Defendants have 
had access to “images” of ads and data “in the same format they were received by the 
government.” (Doc. 696. at 7.) Defendants’ Motion showed that the government’s 
production of “images” is useless, as it amounts to disjointed data with no functionality to 
search for related information or to analyze and present cumulative data. See Motion at at 9- 
15 & Exs. H-L (Docs. 643-9 through 643-12). With this reply. Defendants also submit a 
declaration of Tami Loehrs, an expert in forensic computer evidence, who confirms that the 
information and data the government has produced to date is not forensicaUy sound and is 
useless. 

Pursuant to Defendants’ constitutional and statutory rights, this Court should order 
the production of the databases in the same functioning condition they were in when the 
government seized them in April 2018. 

_ 1 _ 
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II. ARGUMENT 

a. Defendants Have Sought and Are Entitled To Obtain a Functioning 
Version of the Backpage.com Website, Databases and Systems. 

Defendants’ Motion sought production of a functioning version of the Backpage.com 
website, databases, and systems, as they existed when the government effected its seizures. 
(Doc. 643.) The government’s prosecution of Defendants is based entirely on their 
connections to the Backpage.com website. The government alleges that all adult ads posted 
by third parties on the website were for prostimtion or sex trafficking, that the operations and 
practices of the website were designed to promote such illegal conduct, and that Defendants 
supposedly knew of or participated in this. The government is prosecuting Defendants for 
the operations and practices of the Backpage.com website. Therefore, the actual website, 
actual ads as they appeared on the site, actual actions to screen, block and report ads, and the 
involvement of Defendants (or lack of involvement) is crucially important to this case and the 
defense. This information was available and readily accessible in the Backpage databases and 
systems as they existed when the government seized them. In its Response, the government 
does not dispute any of this.^ 

b. Tbe Government’s Opposition is Irrelevant to Defendants’ Motion. 

Defendant’s Motion sought “Backpage servers and the databases and material on those 
servers, in a functional and operational format.” Motion at 1. Instead of addressing that issue, 
the government offers arguments purporting to show that it has complied with discovery 
obligations generally in ways that have nothing to do with this Motion. Defendants do not 
agree that the government has complied with its obligations under Rule 16, Jencks, Bradj, or 


1 Indeed, the government has made clear that functionality of the databases is important in 
this case. As previously noted, the government included in its search warrant application the 
need to obtain “historical” data and “all versions of an advertisement.” (Doc. 643-4 at 12.) 
In seeking judicial warrants, the government committed that it would take appropriate steps 
to preserve and not “alter the original evidence” as existed and was accessible on the website, 
databases and systems. {Id., at 11-12.) Even in its Opposition to the Motion, the government 
relates that it told Danish authorities “to preserve the servers” there in order “to search and 
display ads as they would have appeared when the Backpage.com site was active.” (Doc. 696 
at 6.) The government’s argument that Defendants’ demand for the functioning Backpage 
databases is a “fishing expedition,” (Id. at 9), is utterly disingenuous. 
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otherwise, but the issues here are not whether the government has produced emails or “hot” 
documents it claims support its case, nor its production of partial exhibit and witness lists. 
The issue is the government’s obligation to preserve and produce the Backpage.com website, 
databases, and systems in a fully useable form — the data and evidence that lies at the heart of 
this case. The government is prosecuting Defendants for publishing a website and admits that 
it “seized” that website, but stiU has not produced it or the data the website and its supporting 
databases and systems contained. 

c. The Government’s Assertions That It Has Produced Actual Data and Ads 
from the Backpage Website Databases and Systems Are False. 

The government tells the Court that it has provided Defendants access to “all of the 
ads and images ... in the same format they were received by the government.” (Doc. 696 at 
7). This is not true. When the government seized the Backpage servers containing the 
databases and systems that ran the website, they were operational and functioning. Personnel 
from Backpage or the government (or anyone with access) could have reviewed all data and 
information from the website in a complete, fuUy functional, easily accessible, and useable 
format and could have searched, tabulated, analyzed, and compared such data. Days after the 
government disclosed its original indictment. Defendants asked that the website and all data 
be preserved in a fuUy-functional format. (Doc. 643-7.) The government has not produced 
data in that format. As Defendants set forth in the Motion (Doc. 643) and in the attached 
declaration of Tami Loehrs (Exh. A), an expert in forensic computer evidence, the “imaged” 
ad data the government extracted from the Backpage servers and produced to Defendants is 
useless, as the raw database information and image dumps produced bear no resemblance to 
ads on the website and it is all but impossible to recreate the ads from that data. Moreover, 
the data is completely disjointed, bereft of any capability to search for related information {e.g., 
about Backpage’s actions to block ads by a user or to report them to law enforcement, etc.) or 
to analyze and present cumulative data {eg, to determine the numbers of ads Backpage 
blocked and removed in a given period, to show that ad text was not edited, etc.). 

The government inaccurately tries to cast Defendants’ Motion as seeking discovery that 

_ 3 _ 
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is different than what the government seized. In reality, the opposite issue is true: the 
government is producing the data in a form different than it seized it. The government’s 
suggestions to the contrary seem a deceit on the Court.^ 

d. The Government Demonstrates That It Violated ESI Protocol. 

The government goes even further, suggesting that the “Recommendations for 
Electronically Stored Information (ESI) Discovery Production in Federal Criminal Cases” (the 
“ESI Protocol”)^ support its position. But the opposite is true. First, the ESI Protocol calls 
for the parties to meet and confer about the “mechanics of producing ESI discovery.” ESI 
Protocol, Principle 3, p. 2. Here, the government made unilateral decisions about producing 
the Backpage FT. systems data without consulting Defendants, and despite Defendants having 
asked days after the original indictment that the website and all data be preserved in a fuUy- 
functional format. (Doc. 643-7.) Second, the ESI Protocol provides that “ESI discovery 
should be done in a manner to facilitate electronic search, retrieval, sorting, and management 
of discovery information” (ESI Protocol, p. 4)—but the manner in which the government has 
unilaterally chosen to produce data from the Backpage I.T. systems does the opposite. Third, 
the ESI Protocol calls for producing data in a form that will meet the goals of “retaining] the 
ESI’s integrity, [| allowing] for reasonable usability, and [[reasonably limiting] costs” (Id., pp. 
9-10)—but the government has produced the Backpage I.T. system data in a manner that 
eviscerates the data’s integrity, destroys the data’s usability, and dramatically increases 
Defendants’ costs. Fourth, the ESI Protocol provides that “ESI received from third parties 
should be produced in the format(s) it was received or in a reasonably usable format(s)” (Id., 
p. 17)—but the government has not produced the Backpage I.T. system data in the form it 
seized it (functional I.T. systems) or in reasonably usable formats. Finally, although the ESI 
Protocol provides that “a party should not be required to take on substantial additional 
processing or formatting conversion costs and burdens” (Id., Principle 5, p. 3)—the 

2 Should the government persist in its claim that it produced the system in the “same 
condition it was seized and received by the government,” Defendants request an evidentiary 
hearing to address whether or not the government did so. 

3 Available at http://www.uscourts.gov/sites/default/files/finalesiprotocolbookmarked.pdf . 
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government seeks to impose exactly such additional costs and burdens on Defendants by not 
producing the functional I.T. system. The government’s invocation of standard ESI protocols 
simply highlights its deficient handling of Backpage.com servers and the databases and 
material that existed on those servers. 

III. CONCLUSION 

The Court should compel the government to provide access to Backpage.corn’s systems, 
servers, databases, and data with the same functionality and in the same condition as they 
existed at the time of their seizure. The Court should further compel the government to 
provide the data and information requested in Doc. 643-13, except as disclosure of the 
Backpage.com servers, databases, and systems may allow Defendants themselves to search, 
obtain, and collect the requested exculpatory data. 


Dated: August 5, 2019 


Dated: August 5,2019 


Thomas H. Bienert, Jr. 

Whitney Z. Bernstein 
BIENERT I KATZMAN PC 

By: /sj Whitney Z. Bernstein 
Whitney Z. Bernstein 
Attorneys for James Larkin 


PaulJ. Cambria, Jr. 

Erin E. McCampbeU 

LIPSITZ GREEN SCIME CAMBRIA LLP 

By: /s/ PaulJ. Cambria, Jr. _ 

PaulJ. Cambria,Jr. 

Attorneys for Michael Lacey 


Dated: August 5, 2019 Robert Corn-Revere 

James C. Grant 

DAVIS WRIGHT TREMAINE LLP 

By: / s/ James C. Grant 
James C. Grant 

Attorneys for Michael Lacey and James Lar ki n 
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Dated: August 5,2019 Bruce Feder 

FEDER LAW OFFICE, P.A. 

By: /sj Bruce Feder 
Bruce Feder 

Attorneys for Scott Spear 

Dated: August 5,2019 Gary S. Lincenberg 

Ariel A. Neuman 
Gopi K. Panchapakesan 

BIRD, M ABE LL A, BOXER, WOLPERT, NESSIM, 
DROOKS, LINCENBERG & RHOW, P.C. 

By: / s/ Ariel A. Bdeuman 
Ariel A. Neuman 
Attorneys for John Brunst 


Dated: August 5, 2019 David Eisenberg 

DAVID EISENBERG, P.L.C. 

By: !sj David Eisenberg 
David Eisenberg 
Attorneys for Andrew Padilla 

Dated: August 5, 2019 Joy Bertrand 

JOY BERTRAND, ESQ. 

By: /V Joj Bertrand 
Joy Bertrand 

Attorneys for Joye Vaught 
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CERTIFICATE OF SERVICE 

I certify that on this 5th day of August 2019,1 electronically transmitted a PDF version 
of this document to the Clerk of the Court, using the CM/ECF System, for filing and for 
transmittal of a Notice of Electronic Filing to the following CM/ECF registrants listed below. 

/ s! Whitney Z. Bernstein _ 

Whitney Z. Bernstein 

Anne Michelle Chapman, anne@mscclaw.com 

Erin E. McCampbeU, emccampbell@lglaw.com 

Anthony R. Bisconti, tbisconfi@bienertkatzman.com 

Ariel A. Neuman, aan@birdmarella.com 

Bruce S. Feder, bf@federlawpa.com 

James C. Grant, iimgrant@dwt.com 

Lee David Stein, lee@mscclaw.com 

Paul]. Cambria, pcambria@lglaw.com 

Robert Corn-Revere, bobcornever@dwt.com 

Ronald Gary London, ronnielondon@dwt.com 

Janey Henze Cook, ianey@henzecookmurphy.com 

John Lewis LittreU, ilittrell@bmkattorneys.com 

Seetha Ramachandran, Seetha.Ramachandran@srz.com 

Thomas H. Bienert, Jr. tbienert@bienertkatzman.com 

Whitney Z. Bernstein, wbernstein@bienertkatzman.com 

Gary S. Lincenberg, glincenberg@birdmarella.com 

Gopi K. Panchapakesan, gpanchapakesan@birdmarella.com 

Michael D. Kimerer, mdk@kimerer.com 

Rhonda Elaine Neff, rneff@kimerer.com 

David S. Eisenberg, david@deisenbergplc.com 

Joy Malby Bertrand, ioyous@mailbag.com 

John Jacob Kucera, iohn.kucera@usdoi.gov 

Kevin M. Rapp, Kevin.Rapp@usdoi.com 

Margaret Wu Perimeter, Margaret.perlmeter@usdoi.gov 

Reginald E. Jones, reginald.iones4@usdoi.gov 

Peter Shawn Kozinets, Peter.Kozinets@usdoi.gov 

Andrew C. Stone, andrew.stone@usdoi.gov 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF ARIZONA 


United States of America 

Plaintiff, 

V. 

Michael Lacey, et ah, 

Defendants. 


Case No. CR- 18 - 422 -PHX-SMB 


DECLARATION OF TAMI LOEHRS 


I, TAMI LOEHRS, hereby declare as follows: 

Qualifications and Experience 

I am a digital forensics expert and owner of Loehrs Forensics, LLC (formerly Loehrs & 
Associates), a firm specializing in digital forensics. My offices are located at 1505 North 
Central Avenue, Suite 111 , Phoenix, Arizona 85004 . I am competent to testify and the 
matters contained herein are based on my own personal knowledge. 

I have been working with computer technology for over 20 years and I hold a Bachelor 
of Science in Information Systems. I have completed hundreds of hours of forensics training 
including courses with Guidance Software and Access Data. I am an EnCase Certified 
Examiner (EnCE), an Access Data Certified Examiner (ACE), a Certified Computer Forensic 
Examiner (CCFE) and a Certified Hacking Forensic Investigator (CHFI). I have conducted 
over one-thousand forensics exams on electronic evidence including hard drives, cell phones, 
removable storage media, security systems, dash cams, and other electronic devices, in 
addition to forensically preserving and analyzing on-line data such as cloud storage and social 
media platforms. I have conducted seminars on Computer Forensics and Electronic 
Discovery throughout the United States. In addition, I hold a Private Investigator Agency 
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License in the State of Arizona which requires a minimum of 6 ,ooo hours investigative 
experience. My Curriculum Vitae is attached as Exhibit A. 

I have been hired as a digital forensics expert on over one thousand criminal and civil 
cases throughout the United States and internationally since the year 2000 and I have 
testified over one hundred and twenty-six times as a digital forensics expert in State, Federal 
and international Courts. 

Role of Loehrs Forensics 

I have been retained as a digital forensics expert by counsel for defendants for the 
purpose of assisting with matters related to the searching, collecting, analyzing and 
producing of electronic evidence in this case. Specifically, the government has alleged that 
Defendants facilitated the promotion of prostitution through the use of the website 
Backpage.com and conspired to commit money laundering. The government seized 
approximately one-hundred and six ( 106 ) servers associated with the operation of 
Backpage.com and these servers were located in Tucson, Dallas and Amsterdam. Using 
industry standard methodologies, techniques and tools, it is the role of Loehrs Forensics to 
assist defendants in accessing the Backpage.com data that resides on these servers for the 
purpose of corroborating or refuting the government’s allegations. 

I have reviewed discovery materials produced by the government including, but not 
limited to, evidence chain of custody forms regarding items collected from 202 S. Tucson 
Blvd, Tucson, AZ on May 3 , 2018,13601 Preston Road, Dallas, TX on May 10 , 2018 and 1855 
N. 6 * Avenue, Tucson, AZ on April 6 , 2018 ; photographs; Joint Status Reports with exhibits; 
and the Superseding Indictment. 

On April 17 , 2019 ,1 flew to Pocatello, Idaho to review fourteen ( 14 ) of the servers in the 
government’s possession. The servers were located on several different tables, with two to 
three servers stacked on top of each other. During my visit, I was restricted to a visual 
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inspection only and was not permitted to photograph the servers or power them up to 
determine the configuration of the servers or the nature of the data contained within. 

On April 23 , 2019 ,1 conducted a similar visual inspection of thirty-two ( 32 ) servers and 
three ( 3 ) external hard drives located at the FBI in Phoenix, Arizona. Again, I was not 
permitted to photograph the servers or power them up to determine the configuration of the 
servers or the nature of the data contained within. Also during that visit, four hard drives 
containing digital evidence in this matter were released to me for my review and analysis to 
be conducted at the Loehrs Forensics lab. 

On May 17 . 2019 , Loehrs Forensics picked up three boxes of evidence from the offices of 
Bruce Feder and took them to the Loehrs Forensics lab for review and analysis. Those three 
boxes contain fifty-six ( 56 ) hard drives produced by the government that purport to be five 
( 5 ) of the one hundred and six ( 106 ) servers seized from Backpage.com. 

Summary of Opinions and Conclusions 

The majority of the electronic data seized from Backpage.com and produced by the 
government does not meet minimum industry standards and is completely unusable in its 
current form. The issues with the data produced by the government includes, but is not 
limited to, the way in which the data was acquired and preserved, the integrity of the data 
produced and the ability or lack thereof to access, review and analyze the data. 

There are nationally and globally accepted standards for documenting, acquiring and 
preserving digital evidence. Some of the most recognized organizations who promote those 
standards include the International Organization for Standardization (www.ISO.org), the 
Scientific Working Group on Digital Evidence (www.SWGDE.org), and the National Institute 
of Standards and Technology (www.NIST.gov). In addition, law enforcement has adopted its 
own standards for acquiring and preserving digital evidence. Regardless of the organization 
or agency setting the standards, the methodologies accepted for acquiring and preserving 
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digital evidence are identical in their purpose, to maintain the integrity of the data being 
acquired and preserved and the government failed to do that in this case. 

Backpage.com Operations 

Based on my review of SA Robinson’s Declaration, Backpage.com relied upon database 
servers, image servers and web servers to host the website as it would have appeared to users 
on the Internet. No one server contains web pages as they were presented to the user when 
the site was active, rather, elements would need to be pulled from multiple servers in order to 
generate an ad as it would have been displayed to the user. In fact, a single advertisement on 
the website may be constructed of multiple files spread throughout numerous servers and 
hundreds of hard drives. Further, any actions taken with regard to an advertisement, such as 
removing it, would also be located among multiple files, multiple servers and multiple hard 
drives all working as a cohesive unit. When any one component of the unit has been damaged 
or removed, the advertisement and any activity associated with that advertisement, may be 
lost. This includes, but is not limited to: 

• whether the ad was blocked and when, 

• whether the source of the ad was blocked and when, 

• whether the ad was removed from the website and when, 

• whether the ad was reported to law enforcement and when, 

• who accessed an ad on the website and what the result was, and 

• which individuals were involved in any of these activities. 

In that regard, it is critical that all Backpage.com servers are acquired and preserved in 
such a manner so as not to destroy or remove any one of these components and maintain the 
data in substantially the same state it was in when it was active on the Internet. 

Data Acquisition and Preservation 

When electronic data becomes evidence in a case, it is up to the forensic examiner to 

assess the digital evidence thoroughly to determine the best course of action to take. Digital 
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evidence is fragile and can easily be altered or damaged. Similar to preserving a crime scene, 
the investigator must protect potential physical evidence from being damaged or destroyed. 
The investigator cannot just tread through the bloody crime scene in street shoes and pick up 
the murder weapon with an ungloved hand, he must assess the situation and plan 
accordingly. Careful considerations must also be made with regard to the tools to be used at 
the crime scene, the methods in which to acquire and preserve the physical evidence and 
careful documentation of the entire process. 

Similar considerations must be made when acquiring digital evidence, especially when 
that digital evidence consists of a complicated, dynamic system that depends upon multiple 
interconnected servers to keep a website up and running. The simple act of powering down a 
server incorrectly may forever alter and destroy the integrity of the data that resides within. 

In addition to considerations on how to approach the preservation of evidence, industry 
standards require that digital evidence be acquired and preserved in a forensically sound 
manner so as not to alter, damage or destroy that data but to maintain the integrity of that 
data. 

When seizing and preserving any electronic media, especially a server, careful 
documentation of its current state, running processes, physically mounted items, and damage 
should be thoroughly recorded and photographed. Because servers can be extremely volatile, 
it is imperative to follow best practices and procedures for each server type and scenario. For 
instance, if a server containing potential evidence is powered on, the current processes, 
network configuration, encryption keys and memory should be captured prior to powering off 
in the event it contains information crucial to properly analyzing the physical hard disks. 
Servers that are located powered on should also be properly powered down using the 
operating system shut down function prior to dismantling any of the physical disks to avoid 
data loss or damage. Servers that are located powered off should be carefully documented to 
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determine if they are connected to a power source, are warm to the touch that may indicate it 
was recently powered on, 

The government has provided very little information, if any at all, as it relates to their 
process of acquiring and preserving the Backpage.com data. In that regard, it is unknown 
when the data was acquired, what tool or tools it was acquired with, the type of acquisition 
conducted, who conducted the acquisition, the name or description of the server being 
acquired, which specific hard drive in the server was acquired, the configuration of the server 
and/or the hard drive being acquired, whether the data was encrypted or otherwise formatted 
in such a way that the integrity of the data could be lost, what processes were running, 
network configurations, verification that the acquisition process was successful or that the 
data has been verified as an exact duplicate of the original. 

Additionally, most of the data acquired by the government was not produced in an 
industry standard format and is not forensically sound. This is tantamount to sending 
someone a document that cannot be opened in Microsoft Word or Adobe, industry standards, 
because the document was created with an unknown program, and then not informing the 
person of the program used. Until the unknown program has been identified and obtained, 
the document remains inaccessible. Because the data produced by the government is not in 
industry standard formats and the government has provided little to no information 
regarding their process for acquiring the data, I am unable to access, identify or restore the 
data to its original condition and the data remains inaccessible and unusable to defendants in 
its current form. 

Integrity of the Data 

Data integrity refers to the accuracy and consistency of data. Essentially, the data 
should be in substantially the same condition as it was when it was taken into custody. In this 
case, the original condition of the Backpage.com data was a working website. That website 
contained millions of advertisements with images and text that could be viewed on the 
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Internet, but also contained internal data related to the editing, blocking, removal, payment 
and reporting of those advertisements. The functionality of the Backpage.com website was 
dependent upon numerous interrelated servers, each server containing multiple internal hard 
drives that also work together as a cohesive unit. If any one of these servers or any single 
hard drive within those servers has not been properly acquired and preserved, the 
Backpage.com website does not function in its original condition. 

The data produced by the government bears no resemblance to the original 
Backpage.com website and the integrity of that data has been destroyed in a number of ways. 
First, the government has not produced all of the interrelated servers required for the 
Backpage.com website to function. Second, the government has not produced valid forensic 
images of the hard drives contained within each of those interrelated servers making it 
impossible to recreate a single server in substantially the same condition as it was when it was 
seized. Third, the government has provided no information regarding the configuration of 
the servers or the hard drives within making it further impossible to recreate a single server 
in substantially the same condition as it was when it was seized. The data, as it has been 
produced by the government, has made it impossible to identify, access or restore the data to 
its original condition and the data remains inaccessible and unusable to defendants in its 
current form. 

Ability to Access the Data 

An important element of having industry standards is to ensure the data acquired can 
be accessed by anyone with the proper tools and expertise. It does not matter how 
experienced or knowledgeable an expert may be, if data is produced in an unknown format 
that does not meet industry standards, cannot be accessed using industry standard tools, and 
no information about that format is provided, the data will be inaccessible and unusable. 

Although the government produced some of the data using industry standard forensic 
formats, even that data has proven to be inaccessible and unusable. Many of the forensic 
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images produced by the government are incomplete, invalid and cannot be read by industry 
standard forensic tools. Although numerous attempts were made at accessing these forensic 
images, using numerous industry standard tools, none were successful and the data remains 
inaccessible and unusable in its current form. 

Conclusions 

The data seized by the government in this case is unique because Backpage.com was a 
working website that relied upon an extensive, complicated system of interconnected servers 
in order to function. However, the government did not document the system before taking it 
down, they did not document their processes for acquiring and preserving the evidence, they 
did not acquire the devices using industry standard methodologies or formats, and they did 
not produce all of the necessary data to restore the Backpage.com website. Rather, the 
government has produced only some bits and pieces of a complex integrated system, some of 
which are broken, with no documentation or information on how it was running when they 
seized it or the tools and methodologies they used to acquire it. This is tantamount to buying 
a large piece of unassembled furniture but realizing you don’t have all the parts, or the 
instructions on how to build it, or pictures of the final product, or the specialty tools required 
for the proprietary hardware required to put it all together. 

The data seized from Backpage.com and produced by the government is undocumented, 
incomplete, broken, inaccessible and unusable. In its current form, the data produced by the 
government does not meet industry standards and the integrity of the data has been altered 
and/or destroyed. 


DATED August f; . 2019 . 



Tami Loehrs, CCFE, CHFI, EnCE, ACE 


DECLARATION OF TAMI LOEHRS - 8 







